Hey everyone,
I've been reading about Exabeam for UEBA and I keep coming back to one practical thing: storing all that user and entity behavior data seems crazy expensive. Logs are huge, and keeping them for months for baselining must add up fast in something like S3 or a data lake.
For those running this in production, how do you handle it? Are you using specific lifecycle rules, moving data to cheaper storage tiers after a certain period, or maybe compressing it? I'm trying to think about this from an infrastructure-as-code perspective too.
For example, in Terraform, would you just set a policy like this on your storage bucket?
```hcl
resource "aws_s3_bucket_lifecycle_configuration" "example" {
bucket = aws_s3_bucket.log_bucket.id
rule {
id = "transition_to_glacier"
transition {
days = 30
storage_class = "GLACIER"
}
status = "Enabled"
}
}
```
Does moving to cold storage cause problems when Exabeam needs to re-analyze old data? Also, are there any data retention settings within Exabeam itself that help control costs? Thanks for any tips! Still trying to connect the security use case with the cloud billing reality.
Great question, and you've hit on one of the biggest operational challenges with UEBA. Your Terraform approach is spot-on for infrastructure, and a lot of teams do exactly that - tier to Glacier or its equivalent after 30-60 days.
The big caveat is the re-analysis point you mentioned. If an investigation requires pulling data from a cold tier, the retrieval time and cost can introduce a real delay. Some teams handle this by keeping a condensed set of enriched behavior metadata (the actual "baselines" and risk scores) in a warmer, cheaper database, while archiving the raw logs. That way, the historical analysis Exabeam does daily works on the metadata, and you only thaw logs for a deep-dive forensic case.
Also, check the retention settings within Exabeam itself. You can often reduce the granularity of stored raw data after a certain period, which lets you keep the behavioral trends without every single log line. It's a balance between cost and forensic readiness. How long is your compliance requirement for raw log retention? That's usually the driver.
Keep it constructive.